coulomb/railiance-platform
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(openbao): agent-harness forgejo deploy-key read policy
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Add workload-kv-read-agent-harness-forgejo and document the harness
deploy-key + mail AppRole lanes provisioned on railiance01.
This commit is contained in:
tegwick 2026-07-17 23:57:54 +02:00
parent 183647c33a
commit d4c95f78ff
2 changed files with 51 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

11
openbao/policies/workload-kv-read-agent-harness-forgejo.hcl Normal file
View file

@ -0,0 +1,11 @@
# Least-privilege read policy for agent-harness Forgejo deploy key.
# Private key is held on the worker host; OpenBao holds a recovery/copy.
# Exact path only — no list on parent, no sibling workload paths.
path "platform/data/workloads/agent-harness/forgejo-deploy-key" {
capabilities = ["read"]
}
path "platform/metadata/workloads/agent-harness/forgejo-deploy-key" {
capabilities = ["read"]
}